[chrisdengso]

Bug: in a project set up with modapi init, commands such as modapi projects list or modapi wordlist list failed with 401 malformed_api_key. They looked for a key only in --secret-key, MODAPI_SECRET_KEY and the modapi configure keychain or config, and found none, so they sent Authorization: Bearer with nothing after it. doctor passed anyway, because it also reads the project's env file.

Key fallback (internal/custom/fallbackkey.go, wired in custom.Register around the root's PersistentPreRunE)

• An explicit key always wins: --secret-key, MODAPI_SECRET_KEY, or modapi configure.
• Otherwise:
  • API commands use MODAPI_SECRET_KEY from the env file in the current directory (.env.local, .env, …, as doctor finds it), then the organization key (MODAPI_ORGANIZATION_KEY, then the modapi login session).
  • projects and channels try the organization key first, because the management API needs one.
• With no key at all, the command stops before sending anything: exit 3, with hints to run modapi init, modapi login, or set the key. --dry-run still works without a key.
• The key reaches the request through MODAPI_SECRET_KEY, which the generated client reads, so no generated file changes.

doctor output (terminal only; -o json and agent mode are unchanged)

Problems
  ✗ No project key found.
    Fix: modapi init

Warnings
  ! MODAPI_WEBHOOK_SECRET is not set. You need it only to verify webhooks.
    Fix: modapi webhook-secret retrieve, then add the secret as MODAPI_WEBHOOK_SECRET

Passed
  ✓ Signed in to Cueup, LLC.

1 problem, 1 warning.

• Coloured when the terminal supports it, and follows --color and NO_COLOR.
• Exits 1 without the generic Error (runtime_error) … CLI_RUNTIME block below.

Tests:

• The .env key is used; an explicit key wins; projects list uses the organization key; with no key, no request is sent and the command exits 3.
• doctor human output, with nothing on stderr.
• go test ./... passes.

Release: this is hand-written code only, so the generator won't bump the version by itself. It ships with the next CLI release. modapi link (next PR, needs moderation-api/api#454) will come with that release.

🤖 Generated with Claude Code